Posted
by
timothy
on Thursday June 19, 2014 @12:19PM
from the ok-ok-using-ios-doesn't-count dept.

DavidGilbert99 (2607235) writes Mobile malware on Android is nothing new, but now security company FireEye has discovered in the Google Play store a sophisticated piece of malware which is posing as....the official Google Play store. Using the same icon but a different name, the malware is not being detected by the vast majority of security vendors, is difficult to uninstall and steals your messages, security certificates and banking details.

Google also allows Android to be set to allow installation from 3rd parties.

So, if you explicitly enabled that, and downloaded something from a shady source... well, you may have shot yourself in the foot.

If this came from the Google Play store, then Google has a problem. If this came from a 3rd party store, then the user has a problem. And if this came from a vendor's proprietary store the vendor has a problem.

I think it comes down to "where did this package come from, and what did you need to do to in

It did. But let me state right off the bat. For each individual that downloaded and ran Google App Stoy... Good. Let your bank account be pwnd. Let your email get taken over. I am ok with your life being ruined because you are an unthinking being. Bye.

How much does it take before you decide a person has no responsibility in their own problems?

More to the point though. Why are people so interested in things not being their fault? My children are taught that the only place you should look when things go bad is to yourself. What could I do differently to get the outcome I desire? When you have no responsibility in the problems in your life you have no power over their solution. With responsi

More to the point: why do you want such consequences for people who do something stupid? Bank account pwned, email taken over, that sort of thing. It isn't going to stop people (including dyslexics) from doing stupid and trusting things. You seem to be hoping that bad things happen to people who make mistakes.

It did. But let me state right off the bat. For each individual that downloaded and ran Google App Stoy... Good. Let your bank account be pwnd. Let your email get taken over. I am ok with your life being ruined because you are an unthinking being. Bye.

So when you get older, and maybe get Alzheimers, it's OK if you get ripped off as an easy target, because you are an unthinking being? Or if you travel and end up getting ripped off because you don't read the foreign language very well. In fact it's not just OK, we should all celebrate because you have lost a lot of money.

You know something, by posting what you did there, you've made a pretty good case for you not being a thinking being now. Or at least not a mensch.

Take a look at the backing crisis. Now given the banks are mostly pieces of shit and should never have been bailed out but...

Some asshole who took out loan on a house that says you will pay $X for Xmonths then we will raise it to $X for Xmonths on the speculation that the housing market will go up forever and he can make a bunch of money is ok by me. If he wants to speculate to make money I am fine with that. But we need to do HARP for these fucke

That's wooly thinking. If your security relies on you spotting a badly spelled app name, you have no security against all those malware authors that didn't misspell their malware.

Furthermore, why did Google not notice the app name and icon ripped off from their own app? Because there is no security on their store. Google will sell anything anyone uploads. Again this cannot happen on the Apple App Store.

Almost every app requests almost every permission anyways, so what was the point of fine-grained permissions? Why do I have to let you access the network and my contact list to play Tetris? It's frustrating.

That's part of the stupid issue. The 'fine grained permissions' were NOT fine enough and some were grouped in odd places. And of course, App Devs being lazy or intrusive, they ask for exceptionally broad permissions often enough. At least with the fine-grained permissions, you could use a third party tool to revoke individual permissions before running the app.

Really, you're making the main valid point here though: App Devs are making mandatory a lot of permissions that ought not be mandatory. That's bad de

Perhaps an app dev can answer one question: If I install with a particular permission set, but an optional feature some users might want would require an additional permission, could I not prompt the user for that permission when they want to enable the optional feature? If this is possible, not doing it is not excusable on behalf of the App Devs. If it isn't possible, it is not excusable on the Android Devs part.

It's not possible on Android.

On iOS it's the way it always works. You are only asked for a given permission at the time the app tries to do the privileged thing.

Yes it is, so long as the separate features are factored into separate packages on Google Play Store. Under Android, packages signed with the same software publisher certificate can share data through the sharedUserId mechanism. This lets the user install one main interactive app, which appears in the launcher or IME chooser or whatever, and then several helper apps that expose content provider services to the main application. For example, a keyboard could have helper apps that extend its autocorrect dicti

My problem is, IIRC, you don't know what broad permissions an app is going to request upfront, until after you have downloaded and partially installed it. By then you have already wasted your time and bandwidth. You are invested. It would take half a day to look at 20 different versions of Tetris to see which is OK. If you could filter Google Play searches - "search for a version of Tetris that doesn't demand to look at my contact list" - then that would create a tiny bit of market pressure to not just

Or you could just take a little bit of personal responsibility for your own actions and decide not to install something. I know it is hard. Having to deny yourself a free Tetris game or slugging through the description of the app on the store to actually read the permissions requested before downloading.

I feel for you, I really do. I think that is a true shame that you were allowed to grow up in an environment that made you such an entitled person. One day if you are lucky life will step in and teach you w

Pretty much every app I try to install wants access to everything to function. I try to install a simple game, it wants access to my phone history, contacts, email, google accounts, and fuck knows what else.

Android phones were sold in some countries before Google Checkout (now Google Wallet). In countries without Google Checkout, Android Market (now Google Play Store) showed only freeware apps. In order to derive revenue from users in those countries, developers had to put ads in their apps. And in order to compete for users with developers that had embraced adware, other developers had to make their apps free as well. Google Wallet has since expanded to far more countries, but the expectation of a freeware p

Almost every app requests almost every permission anyways, so what was the point of fine-grained permissions? Why do I have to let you access the network and my contact list to play Tetris? It's frustrating.

Part of the problem is Google itself - when Android was released, the only place you could buy apps was in the US, which mean everywhere else trying to hit Google Marketplace was restricted to seeing free apps. Which means developers end up writing free apps loaded with advertising and having to request

Some Android devs are trying to do their best to work around it. It requires root, but I highly recommend the XPrivacy tool, which will allow you to restrict what apps can actually contact. I also like using a DroidWall successor as a thing of last resort, especially with apps that are bandwidth hungry, so they get forced to Wi-Fi only and not on the cellular network.

LBE Privacy Guard used to be a good tool, but the successor has yet to be officially translated to English yet.

This kind of thing probably wouldn't happen if Android were Free/Libre Open-Source Software. As Google quietly effectively close-sources Android piecemeal, by making it so that parts of the OS, as provided are Google-PROPRIETARY, like the store itself, security problems will abound. It's only natural. To save time, money, and ink, Google's shortened it's motto by one word, and didn't tell anyone. The one word, in case you didn't already guess, is "Don't". They're every little bit as bad as M$ ever was,

Why doesn't Android have a permissions structure that allows the user to explicitly manage the permissions for each app?

If I want to disable access to the contacts for any given app, I should be able to do that. If it breaks functionality of the app, then that is MY problem, but in most cases, it wouldn't cripple the app; I don't need my shopping list to be able to read my contacts and send premium text messages on my behalf.

So, all I have to do is enable apps from outside the official store, download from an unknown site, and then I'll have full access to 1,100 apps!, which almost all also exist in the Play store, which I don't have to enable outside apps and download from an unknown source?

This is yet another piece of software which the user needs to download, enable installation of third-party apps, and install. Or the user might've installed it from a dodgy app store (in which case their device is likely already a teeming mess of malware).

Either way, the user needs to do something we've spent the last umpteen years trying to indoctrinate people against.

Wake me up when someone starts injecting this stuff through advertisements in web pages.

So I R'd TFA, and I can't see anything which says *how* you get this. Or if it's in there I can't find it.

I assume it either piggy backs on something else downloaded from the app store, or comes in from someone enabling apps to come from other places.

The fact that an application can even disable the uninstall feature is pathetic.

And, sadly, Google has removed even more permissions control, so this will only get worse.

I still maintain I should be able to go in at any time and remove permissions from apps -- because, quite frankly, why something like a Flashlight needs access to my messages and contacts has always been a mystery.